The hardware list: what a listing says, who may vouch, and a check that holds each row to its report

[DevomB]

The hardware list: which machines Kryptik has been run on, who ran it, and what each run showed. Stacked on #180, whose commits are the first four here; the list is built on its report.

The page, docs/hardware.md, says what a report is and the two ways to take one, what a row of each level says, who may vouch, and how a row enters the list. The list itself, docs/hardware/list.tsv, starts empty, with one report beside it per row once the hardware tests planned for October 2026 bring some.

Two levels, each defined by what the report shows, so a row cannot claim more than its evidence:

• reported: the report is whole, names its machine, release and kernel, and holds no hardware address, UUID or serial number. It says what the machine has and what the image lacks for it.
• certified: all of that on an installed system: a release and not a dated build, booted by UEFI with Secure Boot on and lockdown in confidentiality, the encrypted state partition in use, a DRM device with an output connected, the default route leaving by a wired or wireless interface that has a carrier, and nothing under missing.

The check, tools/check-hardware.sh: given reports, it prints what each shows and the level it carries, with every reason it falls short of certified; with --list it holds each row to its report, refuses a report that holds an identifier (naming the line, never its content) and a report without a row. tools/tests/check-hardware.sh covers each criterion and each refusal, and ends on the tree's own list, so CI runs the real check with no workflow change.

The report gains what a listing needs and it did not say: state: in its system section, and the net zone's interfaces by kind (wired, wireless, virtual) with the one the default route leaves by; no address is printed. The reporter's fixture suite now feeds its report to the checker, so the two cannot drift apart.

The sound in a listing. The check reads the report's audio section into one audio line, by the kinds of docs/design/laptop-audio.md: the HD Audio codecs, the graphics' HDMI ones left out, then any microphones on Intel's DSP, SoundWire parts, microphones on AMD's coprocessor and amplifiers, each with what drives it or "not driven". No level asks for any of it, and a report from before the section says so and keeps its level. The checker's suite tests the good report's line, the same report driven by SOF and one with no section; the reporter's suite gives each of its five kinds the listing it carries.

In acceptance, the hardware-report item holds the reports it takes to the listing they carry: the medium's is reported; and the installed disk, booted with the medium's certificate enrolled, a display and a network, takes a report that must be certified, or on a dated build short of it in that one thing.

For whoever merges the docs changes that are open: the README's documentation list and the roadmap's Version 2 line on a hardware certification list can point at docs/hardware.md. Not to be merged before #180, nor before v1.0.0 is tagged.